Medium severity4.3NVD Advisory· Published Oct 22, 2026
CVE-2026-115322
CVE-2026-115322
Description
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/rollout_service.gonvd
- github.com/bytebase/bytebase/commit/bb553e8423b38c826cd7b1da5c7117080cc8705dnvd
- github.com/bytebase/bytebase/issues/19369nvd
- github.com/bytebase/bytebase/pull/19554nvd
- github.com/bytebase/bytebase/releases/tag/3.16.0nvd
- www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-rollout-service-task-run-handlersnvd
News mentions
0No linked articles in our index yet.